FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
syao
Staff
Staff
Article Id 295291
Description This article describes how the FortiGate behaves when the BGP 'bestpath-med-missing-as-worst' is enabled.
Scope FortiGate v7.0 and above.
Solution

Consider the following network diagram and its setup:

  • FortiGate receives route advertisements for 4.4.4.4/32 from RTR2 and RTR3 via eBGP.
  • RTR2 is advertising 4.4.4.4/32 without MED, while RTR3's advertisement has a MED of 100.
  • The MED value will be set to 0 if the NLRI from the peer has no MED path attribute.

    diagram-bgp-missing-med.png

By default, FortiGate will choose the route with a lower MED, which in this case is from RTR2, according to the BGP best path route selection as shown below:

 

FortiGate # get router info bgp network 4.4.4.4
VRF 0 BGP routing table entry for 4.4.4.4/32
Paths: (2 available, best #1, table Default-IP-Routing-Table)
Not advertised to any peer
Original VRF 0
200
10.10.100.2 from 10.10.100.2 (2.2.2.2)
Origin IGP metric 0, localpref 100, valid, external, best 
Last update: Mon Jan 22 09:30:49 2024

Original VRF 0
200
10.10.200.2 from 10.10.200.2 (3.3.3.3)
Origin IGP metric 100, localpref 100, valid, external
Last update: Mon Jan 22 09:28:06 2024

 

When the 'bestpath-med-missing-as-worst' setting is enabled in FortiOS BGP, FortiGate will change the MED value to 4294967294 for all the NLRI it receives that have no MED path attribute.

 

config router bgp

    set bestpath-med-missing-as-worst enable <-----

end

 

After enabling the 'bestpath-med-missing-as-worst' setting, FortiGate changed the MED path attribute from R2 to 4294967294 and now prefers the path to RTR3.

 

FortiGate # get router info bgp network 4.4.4.4/32
VRF 0 BGP routing table entry for 4.4.4.4/32
Paths: (2 available, best #2, table Default-IP-Routing-Table)
Not advertised to any peer
Original VRF 0
200
10.10.100.2 from 10.10.100.2 (2.2.2.2)
Origin IGP metric 4294967294, localpref 100, valid, external
Last update: Mon Jan 22 09:30:49 2024

Original VRF 0
200
10.10.200.2 from 10.10.200.2 (3.3.3.3)
Origin IGP metric 100, localpref 100, valid, external, best
Last update: Mon Jan 22 09:28:06 2024

 

Contributors